Vormetric Data Security

Transcription

1 Vormetric Data Security September 2015 George H. Chew AVP for Asia Pacific and Japan Vormetric, Inc

2 Sensitive Data is Dispersing and Growing Becoming harder to secure Physical Virtual Outsourced Enterprise Data Centers Private, Public, Hybrid Clouds 2013: 1 Zettabyte of sensitive data not protected 2020: 10 Zettabytes of exposed sensitive data - IDC 2014 Sources Nodes Analytics Remote Servers Big Data Slide No: 2

3 Traditional IT Security Challenges Never Subside Massive Security Breach At Sony Forbes Apple toughens icloud security after celebrity breach - BBC Slide No: 3 Singapore Personal Data Protect Act in force at 2014

4 Top Concerns for Cloud and Big Data Security and compliance Top Security Concerns With Cloud Computing Data Privacy and Security 41% Access and Control Auditing and Compliance 35% 32% Control of Data 26% Big Data Market Forecast By % of corporate data traffic will bypass traditional perimeter security defenses - up from 4% today. Security Models/ Toolsets Contractual/ Legal Issues Internal Issues Network Connection Security Geographical Coverage 18% 15% 11% 10% 4% March 2014 By 2018, 25% of corporate data traffic will bypass traditional perimeter security defenses up from 4% today. - Gartner, Nov 2013 The biggest growth inhibitors for Big Data market are security and privacy concerns. - Wikibon, Jan Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

5 Growing Islands of Encryption Is coming at a high cost 70% 5+ encryption vendors Feb Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

6 Islands of Encryption A disjointed, expensive collection of point products Database Encryption Full Disk Encryption Data Masking Tokenization Cloud Encryption File Encryption Access Policies Customer Records Physical Security PHI Cloud Migration $ + $ + $ + $ + $ + $ + PCI Big Data Privileged User Control $ Each use case requires individual infrastructure, management consoles and training Complex Inefficient Expensive

7 World-Class Brands Rely on the Vormetric Data Security Platform Global Customers Over 1,300 customers 17 of the Fortune 25 Cloud Service Providers Trust Vormetric Cloud Managed Services Most Security Conscious Brands Largest financial institutions Largest retail companies Major manufacturers Third party business service providers Government agencies OEM Partners IBM Symantec With Vormetric, people have no idea it s even running. Vormetric Encryption also saved us at least nine months of application rewrite effort, and its installation was one of the easiest we ve ever experienced. Karl Mudra, CIO Delta Dental of Missouri 7

8 8 World-Class Brands Rely on the Vormetric Data Security Platform

9 Vormetric Data Security Platform Solving the inefficiencies of point product solutions Cloud First public cloud reference Cloud Managed Services Big Data Key Management TDE PKCS#11 KMIP Compliance Vormetric Application Encryption Security Intelligence App SmartConnector ESM Slide No: 9 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

10 Vormetric Data Security Platform 2.0 Expansion: Tokenization, Cloud Gateway, and Data Masking

11 Vormetric Data Security Platform Solves inefficiencies of point product solutions Vormetric Transparent Encryption Vormetric Application Encryption Tokenization/Data Masking Structured Databases Big Data File and Volume Level Encryption Access Control Unstructured Files Applications Big Data Cloud Field Level Data Encryption Vormetric Key Management KMIP Compliant Oracle and SQL Server TDE Certificate Storage Vormetric Security Intelligence Splunk HP ArcSight IBM QRadar LogRhythm Vormetric Data Security Manager Key and Policy Manager

12 Vormetric Transparent Encryption How it works Privileged Users - _}?$%-:>> Approved Processes and Users John Smith 401 Main Street Vormetric Security Intelligence Logs to SIEM User Encrypted & Controlled Clear Text User Application Application/SAP DSM DSM Database Database File Volume Systems File Managers Volume Systems Managers Allow/Block Encrypt/Decrypt Cloud Admin, Storage Admin, etc Vormetric Data Security Manager virtual or physical appliance Storage Server Big Data, Databases or Files - _}?$%-:>> 13

13 Making Encryption Efficient 2% overhead at 70% system utilization 4% at 100% Benefits More CPU cycles for work More applications More data protection MS SQL TDE is 28%

14 Vormetric Application Encryption How it works Privileged Users - _}?$%- :>> John Smith 401 Main Street Approved Processes and Users Encrypted Clear Text Vormetric Security Intelligence Logs to McAfee Enterprise Security Manager (ESM) User Vormetric Data Security Manager on Enterprise premise or in cloud virtual or physical appliance File Systems Application Database Storage Volume Managers Name: Jon Dough SS: if030jcl PO: Jan Allow/Block Encrypt/Decrypt Big Data, Databases or Files Cloud Provider / Outsource Administrators *$^!@#)( - _}?$%- :>> 15

15 Vormetric Tokenization Simplifying application-layer tokenization * Customer App Servers REST API 5 Vormetric Token Server (Virtual Appliance) DSM Database Token Vault** ((CC)e, Token) Lookups * New and expired keys ** Oracle, customer provided, phase 1 Credit Card Token or mask Slide No: 16 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

16 Vormetric Cloud Gateway Encrypting and controlling SaaS data Security Intelligence Personal Computers Mobile Devices DSM Vormetric Cloud Gateway Q Future Servers Enterprise SaaS Slide No: 17 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

17 Vormetric Data Security Platform 2.0 Enabling an enterprise data-at-rest security strategy Flexible Enterprise-wide protection and compliance History of delivering new use cases enabling secure innovation Scalable Multi-operating systems across all server environments Global scale with centralized control Efficient High-performance, minimizes system resources Operational simplicity through consistent deployment Single Platform = Lower TCO Tokenization Data Masking Cloud & Gateway Transparent Encryption Application- Layer Key Management Slide No: 18 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

18 Vormetric Data Security Manager Accelerating time to value with consolidated control Centrally manage keys and policy Virtual and physical appliance High-availability with cluster Multi-tenant and strong separation of duties Proven 10,000+ device and key management scale Web, CLI, API Interfaces FIPS certified KMIP DSM DSM Vormetric Data Security Manager Policy and key Management Web GUI CLI / API

19 Security Intelligence, Detecting Abuse Splunk App example It is suspicious that Dirk has so many denied file access events. This behavior might be abuse or malware with Dirk s credentials. Vormetric Confidential

20 Admin Dirk Snowman imitated user steve attempted to read this file and was denied access because he violated this policy

21 Vormetric Deployment Examples Slide No: 22 Copyright 2014 Vormetric, Inc. All rights reserved..

22 Controlling and Securing Data in the Cloud DSM in the cloud or on the customer premise Enterprise Data Center Environment Policies & Logs VPN Link VM DSM Keys Vormetric Data Security Manager Virtual or Physical Servers Enforce separation of provider and enterprise responsibilities Extensible to multiple cloud providers and traditional servers Pay as you grow, deploy licenses on demand Customer is always the custodian of policies and keys

23 Protected Dispersed Physical Servers Retail example High-availability with distributed clusters Local access and protection remain even if the communication with DSM goes down. Add agents remotely and pay as you grow to lower TCO Protects from unauthorized access and lost data when servers are stolen for security and compliance 24 Currently support several +10K site deployments

24 Questions? Slide No: 25 Copyright 2014 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

25 Leverage Existing Investments Slide No: 26 Vormetric gives our customers best in class security controls needed for compliance, data breach protection and for safeguarding critical intellectual property through powerful data-at-rest encryption. Rod Hamlin Vice President Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

26 Success Stories Slide No: 27 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

27 Success Story Ensuring a trouble free ticketing system CHALLENGE Fujitsu was concerned with the amount of sensitive client information that was being uploaded into their trouble ticketing system. SOLUTION Vormetric ran a proof of concept which encrypted data in a MSFT environment. Sensitive data was encrypted with no impact to Fujitsu s daily operations. RESULTS Encryption is performed throughout the Fujitsu environment, including replicated database instances. Albert Avila, business solutions specialist at Fujitsu America, Inc., remarked Despite how pervasively we re encrypting data, users have no idea what is being done. Performance issues were originally a major consideration for us: our users are very demanding and we interpret the total lack of any negative feedback to be a great success. Because we had the Vormetric solution in place, we were able to quickly and effectively onboard new clients, including those with contractual requirements for encryption. The initial driver to implement encryption was to safeguard sensitive data that had been uploaded to our systems, and since then, we ve highlighted this capability as a standard part of our strategy. Slide No: 28 Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

28 Success Story Mission Critical; Life Critical Slide No: 29 CHALLENGE McKesson is subjected to an enormous number of regulatory standards for securing data found in every one of the segments in which it operates. Sabastian High, senior manager for Product Development Standards and Innovation at McKesson, commented, We needed to identify an enterprisewide solution for encryption and key management that could be easily deployed across our business units without impacting operations or security. SOLUTION After a multi-month trial period, Vormetric consistently scored the highest marks well above the acceptance criteria with no impact or latency introduced. I also appreciated Vormetric s approach to encryption; I was never satisfied with the competitors strategies of encrypting individual tables or columns, both of which made no sense to us. said Sabastian High, senior manager for Product Development Standards and Innovation at McKesson. RESULTS Since beginning the enterprise-wide deployment, reliability of the Vormetric solutions has been impeccable. High described, We ve never had a Vormetric Data Security Manager appliance fail, or even falter. Agent reliability has been equally flawless. He continued, The separation of key operators, key creator, policy, administrator, access controls, and the separation of duties model are all truly military grade; and I have a lot of experience in this field! Vormetric Data Security provides full coverage of all regulated data throughout the McKesson infrastructure, including facilitating compliance with the HIPAA HITECH Act, PCI DSS, FDA and EPCS (Electronic Prescriptions for Controlled Substances) mandates. Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

29 Success Story Keep on trucking - securely CHALLENGE Con-way handles large volumes of personally identifiable information (PII) for customers around the world. Its role as a provider of transportation services gives the company some unique and valuable perspectives. Con-way had large amounts of both structured and unstructured data and had a need to encrypt and also manage their own keys. SOLUTION Slide No: 30 We felt that the Vormetric Data Security solution which encompasses Vormetric Encryption and Vormetric Key Management would give us more sophisticated and comprehensive capabilities than a combination of competing products, recalled Praveen Sharabu, senior director of Con-way s IT Infrastructure and Vendor Management Office. Another significant factor was the way that Vormetric avoids us having to make any changes to our applications, storage or internal processes. We really liked being able use a single integrated solution for data encryption and key management to secure our diverse set of structured and unstructured data across the environment. RESULTS The company used Vormetric professional services to assist in the implementation and the subsequent transition to becoming fully operational. Sharabu noted, It only took an hour or two per server, depending on the number and size of files to be encrypted. The Vormetric solution s lightweight footprint is clearly structured to minimize the effect on transactional throughput. The encryption appliances don t impose any noticeable latency on application performance. The Vormetric solution really is transparent to users. Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

30 Learn More Visit Vormetric.com Contact Slide No: 31

31 Vormetric User Access Controls (With VTE) Process and user aware file access policies Authorized User Group: HR App: ERP What: Read File Time: 2PM 11/14/2014 Where: HR ERP Directory Vormetric Transparent Encryption HR ERP Directory Unauthorized User Root User Group: Finance App: IE 9.0 What: Read File Time: 5pm 11/14/2014 Where: HR ERP Directory Group: SystemAdmin Process: Cat command What: Read File Time: 2PM 11/14/2014 Where: HR ERP Directory Access Policy #1 User: HR-Group App: ERP Opp: Read Only Time: Any Resources: Any Block access and log attempt Data File access polices can be very granular. User access can be controlled by application, allowed operations, time and the file or resource they attempt to access. Copyright 2015 Vormetric, Inc. Proprietary and Confidential. All rights reserved.

32 Policy Example: Structured Data (SQL, Oracle, etc) # Resource User Process Action Effects 1 DB and Log files DB Service account DB binary (sqlservr.exe, oracle) read/write permit, encrypt/decrypt 2 3 DB and Log files Administrative accounts * read metadata only permit, audit DB and Log files * * * deny, audit Policy Summary: Only the DB Service account, using the whitelisted DB binaries have full transparent access to the encrypted DB objects. The privileged administrative accounts are allowed to manage the encrypted DB objects but have no ability to decrypt the DB objects. Deny and Audit non-conforming data requests at the I/O layer. 33 Policy Benefits Database encryption, without changing database schema or application code. Remove custodial risk of privileged account compromise. Copyright 2012 Vormetric, Inc. - Proprietary and Confidential. All Rights Reserved.

33 Policy Example: Unstructured Data # Resource User Process Action Effects \<share>\*.ext..\<share>\*.ext Directory Users / Groups Administrative accounts Whitelisted Application binaries read/write * read metadata only permit, encrypt/decrypt permit, audit..\<share>\*.ext * * * deny, audit Policy Summary: Only the authenticated & authorized users, using the whitelisted Application binaries have full transparent access to the encrypted data. The privileged administrative accounts are allowed to manage the encrypted data but have no ability to decrypt the data. Deny and Audit non-conforming data requests at the I/O layer. 34 Policy Benefits Unstructured data encryption, without changing how authorized users and processes access the data. Remove custodial risk of privileged account compromise. Copyright 2012 Vormetric, Inc. - Proprietary and Confidential. All Rights Reserved.